CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 05:50 UTC)

What this means for you

This week: 5,436 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product python:python. Show all products

66 CVEs, showing 1 to 50Page 1 of 2Next

CVE	Severity	Title	Published
CVE-2026-15308	High 7.5	The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.	Jul 9, 2026
CVE-2026-4360	Medium 5.3	In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.	Jun 30, 2026
CVE-2026-0864	Medium 5.5	When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and…	Jun 23, 2026
CVE-2026-7210	High 7.5	`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this…	May 11, 2026
CVE-2026-3087	High 7.5	If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different tha…	Apr 27, 2026
CVE-2026-6019	Medium 6.1	http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context.	Apr 22, 2026
CVE-2026-4519	Low 3.3	The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.	Mar 20, 2026
CVE-2026-4224	High 7.5	When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.	Mar 16, 2026
CVE-2026-3644	High 7.5	The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete.	Mar 16, 2026
CVE-2025-13462	Low 3.3	The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK.	Mar 12, 2026
CVE-2025-12781	Medium 5.3	When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars"…	Jan 21, 2026
CVE-2025-12084	Medium 5.3	When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic.	Dec 3, 2025
CVE-2025-13837	Medium 5.5	When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues	Dec 1, 2025
CVE-2025-13836	High 7.5	When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length.	Dec 1, 2025
CVE-2025-6075	Medium 5.5	If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.	Oct 31, 2025
CVE-2022-48560	High 7.5	A use-after-free exists in Python through 3.9 via heappushpop in heapq. Assigned by mitre	Aug 22, 2023
CVE-2023-24329	High 7.5	An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Assigned by mitre	Feb 17, 2023
CVE-2022-45061	High 7.5	An issue was discovered in Python before 3.11.1. Assigned by mitre	Nov 9, 2022
CVE-2022-37454	Critical 9.8	The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic… Assigned by mitre	Oct 21, 2022
CVE-2020-10735	Medium 6.2	A flaw was found in python. Assigned by redhat	Sep 9, 2022
CVE-2021-4189	Medium 5.3	A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. Assigned by redhat	Aug 24, 2022
CVE-2021-28861	Medium 6.5	Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. Assigned by mitre	Aug 23, 2022
CVE-2015-20107	High 7.8	In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. Assigned by mitre	Apr 13, 2022
CVE-2018-25032	High 7.5	zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. Assigned by mitre	Mar 25, 2022
CVE-2022-26488	High 7.0	In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. Assigned by mitre	Mar 7, 2022
CVE-2021-3733	Medium 6.5	There's a flaw in urllib's AbstractBasicAuthHandler class. Assigned by redhat	Mar 7, 2022
CVE-2021-3737	High 7.5	A flaw was found in python. Assigned by redhat	Mar 4, 2022
CVE-2022-0391	High 7.5	A flaw was found in Python, specifically within the urllib.parse module. Assigned by redhat	Feb 9, 2022
CVE-2021-3426	Medium 5.7	There's a flaw in Python 3's pydoc. Assigned by redhat	May 20, 2021
CVE-2021-29921	Critical 9.8	In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. Assigned by mitre	May 6, 2021
CVE-2021-23336	Medium 5.9	Web Cache Poisoning Assigned by snyk	Feb 15, 2021
CVE-2021-3177	Critical 9.8	Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untru… Assigned by mitre	Jan 19, 2021
CVE-2020-27619	Critical 9.8	In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. Assigned by mitre	Oct 22, 2020
CVE-2020-26116	High 7.2	http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by ins… Assigned by mitre	Sep 27, 2020
CVE-2020-15801	Critical 9.8	In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. Assigned by mitre	Jul 17, 2020
CVE-2019-20907	Medium 5.5	In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. Assigned by mitre	Jul 13, 2020
CVE-2020-15523	High 7.8	In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native appl… Assigned by mitre	Jul 4, 2020
CVE-2020-14422	Medium 5.9	Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an applica… Assigned by mitre	Jun 18, 2020
CVE-2019-9674	High 7.5	Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. Assigned by mitre	Feb 4, 2020
CVE-2020-8492	Medium 6.5	Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks agains… Assigned by mitre	Jan 30, 2020
CVE-2020-8315	Medium 5.5	In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.… Assigned by mitre	Jan 28, 2020
CVE-2019-5010	High 7.5	An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6.	Oct 31, 2019
CVE-2019-18348	Medium 5.4	An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. Assigned by mitre	Oct 23, 2019
CVE-2019-16935	Medium 6.1	The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field.	Sep 28, 2019
CVE-2019-16056	Medium 5.3	An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. Assigned by mitre	Sep 6, 2019
CVE-2019-15903	Medium 6.5	In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumn… Assigned by mitre	Sep 4, 2019
CVE-2018-20852	Medium 4.3	http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong serv…	Jul 13, 2019
CVE-2019-12900	Critical 9.8	BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. Assigned by mitre	Jun 19, 2019
CVE-2019-10160	Critical 9.8	A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which s… Assigned by redhat	Jun 7, 2019
CVE-2019-9948	Critical 9.1	urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggerin… Assigned by mitre	Mar 23, 2019

Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.